WPMU DEV

Related CVEsby mentions

• CVE-2026-8222210.02%
  Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin
  CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.
  · Liquid Web / StellarWP GiveWP (WordPress plugin) all versions from n/a through 4.16.7.1 PoC large
• CVE-2026-195989.83%
  Unauthenticated Privilege Escalation in WordPress Pods Plugin Enables Site Takeover
  The Pods – Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) routes every access check on its pods_admin AJAX router — the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which in the JSON meta-box-loader compatibility path only writes a PHP error-log entry and returns false instead of terminating the request. As a result, an unauthenticated request sent through this AJAX path passes all of the plugin's guards without being stopped and can invoke privileged administrator actions. An attacker can escalate to Administrator or overwrite the password of any user account, including the site owner's, achieving complete site takeover or performing other administrator-level actions. Any WordPress site running an affected version of the plugin is exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, though the 9.8 CVSS score and elevated EPSS (2.8%, 86th percentile) make it a high-priority patching target.
  · Pods Foundation Pods – Custom Content Types and Fields (WordPress plugin) All versions up to and including 3.3.9mass
• CVE-2026-157489.85%
  Unauthenticated RCE via Arbitrary File Upload in Forminator Forms WordPress Plugin
  Forminator Forms, a widely used WordPress form-builder plugin, is vulnerable to an unauthenticated arbitrary file upload (CWE-434) in its handle_file_upload function in all versions up to and including 1.56.1. The weakness stems from insufficient file type validation: the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, while the public form-submission handler trusts upload field configuration that an attacker controls by forging a Select field value in a submitted form. An unauthenticated attacker can therefore upload files that may be executable, such as PHP scripts, achieving remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Any WordPress site running Forminator Forms 1.56.1 or earlier, particularly those with publicly reachable forms, is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently assigns a 4.6% probability of exploitation within 30 days (91st percentile).
  · WPMU DEV Forminator Forms (WordPress plugin) All versions up to and including 1.56.1 (<= 1.56.1)large
• CVE-2026-765819.8<1%
  Unauthenticated Admin Authentication Bypass in WPMU DEV Dashboard 5.0.1 and earlier
  CVE-2026-76581 is a critical authentication bypass (CWE-347) in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.1, caused by inconsistent HMAC message construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions: step 1 signs an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1, move the domain value into the redirect field, and replay the signature to step 2, which accepts it and returns an authenticated administrator session. Only sites connected to WPMU DEV with Hub single sign-on (SSO) enabled and mapped to an administrator account are exploitable, and a successful attack grants full admin access, typically enabling complete site takeover. No exploitation has been reported: the flaw is not in CISA KEV, EPSS estimates a 0.3% probability of exploitation within 30 days, and no public proof-of-concept is known.
  · WPMU DEV Dashboard (WordPress plugin) All versions up to and including 5.0.1large
• CVE-2026-196329.8<1%
  Unauthenticated Sensitive Information Exposure in TranslatePress WordPress Plugin
  TranslatePress – Translate Multilingual sites with AI Translation for WordPress, in all versions up to and including 3.3.1, leaks sensitive data through its unauthenticated 'trp_get_translations_regular' AJAX action (CWE-640). When automatic string saving is enabled (the plugin's default) and an administrator's profile locale is set to a published secondary language, the raw password-reset URL — containing the plaintext reset key and login parameters — is persisted in the secondary-language translation dictionary table. An unauthenticated attacker can then retrieve these stored strings via the AJAX endpoint and use the leaked reset key to take over the administrator account. Any WordPress site running the affected versions under those configuration conditions is exposed. No public proof-of-concept or confirmed exploitation is known; the flaw is not in CISA KEV and EPSS estimates a 0.8% probability of exploitation within 30 days.
  · TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) All versions up to and including 3.3.1large
• CVE-2026-184319.8<1%
  Unauthenticated Arbitrary File Write to RCE in Avada WordPress Theme
  CVE-2026-18431 is a critical (CVSS 9.8) arbitrary file write vulnerability in the Avada WordPress theme (all versions through 7.16) that is exploitable when the bundled Fusion Builder plugin (all versions through 3.16) is also installed and active. A chain of missing authorization (CWE-862) and input validation weaknesses across the two components allows unauthenticated attackers to write attacker-controlled files to the server. Because the attacker can create and execute arbitrary PHP files, successful exploitation leads to remote code execution and complete site compromise. Exploitation requires both components to be active and certain administrator-authored content to be present, narrowing the practical attack surface. No public proof of concept, in-the-wild exploitation, or KEV listing is currently known, and EPSS estimates only a 0.6% chance of exploitation within 30 days.
  · ThemeFusion Avada theme for WordPress all versions up to and including 7.16 · ThemeFusion Fusion Builder plugin for WordPress all versions up to and including 3.16 (when installed and active)mass
• CVE-2026-158269.84%
  Unauthenticated Admin Login Bypass in WordPress User Profile Builder Plugin (≤3.16.4)
  CVE-2026-15826 is an unauthenticated authentication bypass caused by type confusion (CWE-704) in the User Profile Builder plugin for WordPress in all versions up to and including 3.16.4. The plugin's wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before checking is_wp_error(); when a registration is submitted with a 61–70 character username, WordPress core returns a WP_Error object, but absint() coerces that object to the integer 1, so the plugin issues an autologin nonce bound to user ID 1 that the attacker can redeem to log in. As a result, an unauthenticated attacker can obtain a session as the site's Administrator account (user ID 1), achieving full administrative takeover of the site. Any WordPress site running the plugin at version 3.16.4 or earlier, with the plugin's registration/autologin flow reachable and user ID 1 holding an Administrator role, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, though EPSS of 3.9% (90th percentile) suggests a moderate likelihood of exploitation within 30 days.
  · Cozmoslabs User Profile Builder (Profile Builder) plugin for WordPress All versions up to and including 3.16.4large

Appears with